libre.sh/keycloak-scim
2
0
Fork 0
Code Issues 14 Pull requests Releases Packages Activity Actions 6

Make script providers working on JDK 17 (#11322)

Browse source 
Closes #9945
This commit is contained in:
Marek Posolda 2022-05-27 12:28:50 +02:00 committed by GitHub
parent 27650ab816
commit eed944292b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
15 changed files with 310 additions and 36 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
model/jpa/src/main/java/org/keycloak/connections/jpa/util/JpaUtils.java
View file

@ -25,7 +25,7 @@ import org.hibernate.jpa.boot.internal.ParsedPersistenceXmlDescriptor;
import org.hibernate.jpa.boot.internal.PersistenceXmlParser;
import org.hibernate.jpa.boot.spi.Bootstrap;
import org.keycloak.connections.jpa.entityprovider.JpaEntityProvider;
import org.keycloak.connections.jpa.entityprovider.ProxyClassLoader;
import org.keycloak.utils.ProxyClassLoader;
import org.keycloak.models.KeycloakSession;
import javax.persistence.EntityManager;

6
pom.xml
View file

@ -118,6 +118,7 @@
<xmlsec.version>2.2.3</xmlsec.version>
<glassfish.json.version>1.1.6</glassfish.json.version>
<wildfly.common.version>1.6.0.Final</wildfly.common.version>
<nashorn.version>15.3</nashorn.version>
<ua-parser.version>1.5.2</ua-parser.version>
<picketbox.version>5.0.3.Final</picketbox.version>
<google.guava.version>30.1-jre</google.guava.version>
@ -592,6 +593,11 @@
<artifactId>jakarta.json</artifactId>
<version>${glassfish.json.version}</version>
</dependency>
<dependency>
<groupId>org.openjdk.nashorn</groupId>
<artifactId>nashorn-core</artifactId>
<version>${nashorn.version}</version>
</dependency>
<!-- Twitter -->
<dependency>

13
quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/integration/QuarkusPlatform.java
View file

@ -19,13 +19,20 @@ package org.keycloak.quarkus.runtime.integration;
import java.io.File;
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLClassLoader;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.ArrayList;
import java.util.LinkedList;
import java.util.List;
import java.util.concurrent.CopyOnWriteArrayList;
import java.util.concurrent.atomic.AtomicBoolean;
import java.util.stream.Stream;
import org.jboss.logging.Logger;
import org.keycloak.Config;
import org.keycloak.platform.Platform;
import org.keycloak.platform.PlatformProvider;
import org.keycloak.quarkus.runtime.InitializationException;
@ -159,4 +166,10 @@ public class QuarkusPlatform implements PlatformProvider {
private void reset() {
deferredExceptions.clear();
}
@Override
public ClassLoader getScriptEngineClassLoader(Config.Scope scriptProviderConfig) {
// It is fine to return null assuming that nashorn and it's dependencies are included on the classpath (usually "providers" directory)
return null;
}
}

64
model/jpa/src/main/java/org/keycloak/connections/jpa/entityprovider/ProxyClassLoader.java → server-spi-private/src/main/java/org/keycloak/utils/ProxyClassLoader.java
View file

@ -1,5 +1,5 @@
/*
* Copyright 2016 Red Hat, Inc. and/or its affiliates
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -13,13 +13,18 @@
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package org.keycloak.connections.jpa.entityprovider;
package org.keycloak.utils;
import java.io.IOException;
import java.net.URL;
import java.util.Arrays;
import java.util.Collection;
import java.util.HashSet;
import java.util.Enumeration;
import java.util.Iterator;
import java.util.LinkedHashSet;
import java.util.Set;
/**
@ -29,7 +34,8 @@ import java.util.Set;
* Effectively it forms a proxy to one or more other classloaders.
*
* The way it works:
* - Get all (unique) classloaders from all provided classes
* - Get list of classloaders, which will be used as "delegates" when loaded classes or resources.
* - Can be retrived from provided classloaders or alternatively from the provided classes where the "delegate classloaders" will be determined from the classloaders of given classes
* - For each class or resource that is 'requested':
* - First try all provided classloaders and if we have a match, return that
* - If no match was found: proceed with 'normal' classloading in 'current classpath' scope
@ -41,17 +47,28 @@ public class ProxyClassLoader extends ClassLoader {
private Set<ClassLoader> classloaders;
public ProxyClassLoader(Collection<Class<?>> classes, ClassLoader parentClassLoader) {
super(parentClassLoader);
init(classes);
/**
* Init classloader with the list of given delegates
* @param delegateClassLoaders
*/
public ProxyClassLoader(ClassLoader... delegateClassLoaders) {
if (delegateClassLoaders == null || delegateClassLoaders.length == 0) {
throw new IllegalStateException("At least one classloader to delegate must be provided");
}
classloaders = new LinkedHashSet<>();
classloaders.addAll(Arrays.asList(delegateClassLoaders));
}
/**
* Get all unique classloaders from the provided classes to be used as "Delegate classloaders"
* @param classes
*/
public ProxyClassLoader(Collection<Class<?>> classes) {
init(classes);
}
private void init(Collection<Class<?>> classes) {
classloaders = new HashSet<>();
classloaders = new LinkedHashSet<>();
for (Class<?> clazz : classes) {
classloaders.add(clazz.getClassLoader());
}
@ -84,4 +101,33 @@ public class ProxyClassLoader extends ClassLoader {
return super.getResource(name);
}
@Override
public Enumeration<URL> getResources(String name) throws IOException {
final LinkedHashSet<URL> resourceUrls = new LinkedHashSet();
for (ClassLoader classloader : classloaders) {
Enumeration<URL> child = classloader.getResources(name);
while (child.hasMoreElements()) {
resourceUrls.add(child.nextElement());
}
}
return new Enumeration<URL>() {
final Iterator<URL> resourceUrlIterator = resourceUrls.iterator();
public boolean hasMoreElements() {
return this.resourceUrlIterator.hasNext();
}
public URL nextElement() {
return (URL)this.resourceUrlIterator.next();
}
};
}
@Override
public String toString() {
return "ProxyClassLoader: Delegates: " + classloaders;
}
}

15
services/src/main/java/org/keycloak/platform/PlatformProvider.java
View file

@ -19,6 +19,8 @@ package org.keycloak.platform;
import java.io.File;
import org.keycloak.Config;
public interface PlatformProvider {
void onStartup(Runnable runnable);
@ -33,4 +35,17 @@ public interface PlatformProvider {
*/
File getTmpDirectory();
/**
* Returns classloader to load script engine. Classloader should contain the implementation of {@link javax.script.ScriptEngineFactory}
* and it's definition inside META-INF/services of the jar file(s), which will be provided by this classloader.
*
* This method can return null and in that case, the default Keycloak services classloader will be used for load script engine. Note that java versions earlier than 15 always contain
* the "nashorn" script engine by default on the classpath (it is part of the Java platform itself) and hence for them it is always fine to return null (unless you want to override default engine)
*
* @param scriptProviderConfig Configuration scope of the "default" provider of "scripting" SPI. It can contain some config properties for the classloader (EG. file path)
* @return classloader or null
*/
ClassLoader getScriptEngineClassLoader(Config.Scope scriptProviderConfig);
}

15
services/src/main/java/org/keycloak/scripting/DefaultScriptingProvider.java
View file

@ -24,7 +24,9 @@ import javax.script.ScriptEngineManager;
import javax.script.ScriptException;
import org.keycloak.models.ScriptModel;
import org.keycloak.platform.Platform;
import org.keycloak.services.ServicesLogger;
import org.keycloak.utils.ProxyClassLoader;
/**
* A {@link ScriptingProvider} that uses a {@link ScriptEngineManager} to evaluate scripts with a {@link ScriptEngine}.
@ -125,8 +127,17 @@ public class DefaultScriptingProvider implements ScriptingProvider {
private ScriptEngine lookupScriptEngineFor(ScriptModel script) {
ClassLoader cl = Thread.currentThread().getContextClassLoader();
try {
Thread.currentThread().setContextClassLoader(DefaultScriptingProvider.class.getClassLoader());
return factory.getScriptEngineManager().getEngineByMimeType(script.getMimeType());
ClassLoader scriptClassLoader = Platform.getPlatform().getScriptEngineClassLoader(factory.getConfig());
// Also need to use classloader of keycloak services itself to be able to use keycloak classes in the scripts
if (scriptClassLoader != null) {
scriptClassLoader = new ProxyClassLoader(scriptClassLoader, DefaultScriptingProvider.class.getClassLoader());
} else {
scriptClassLoader = DefaultScriptingProvider.class.getClassLoader();
}
Thread.currentThread().setContextClassLoader(scriptClassLoader);
return new ScriptEngineManager().getEngineByMimeType(script.getMimeType());
}
finally {
Thread.currentThread().setContextClassLoader(cl);

35
services/src/main/java/org/keycloak/scripting/DefaultScriptingProviderFactory.java
View file

@ -23,10 +23,8 @@ import org.jboss.logging.Logger;
import org.keycloak.Config;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.KeycloakSessionFactory;
import org.keycloak.protocol.oidc.OIDCWellKnownProviderFactory;
import javax.script.ScriptEngine;
import javax.script.ScriptEngineManager;
/**
* @author <a href="mailto:thomas.darimont@gmail.com">Thomas Darimont</a>
@ -35,30 +33,28 @@ public class DefaultScriptingProviderFactory implements ScriptingProviderFactory
private static final Logger logger = Logger.getLogger(DefaultScriptingProviderFactory.class);
static final String ID = "script-based-auth";
private ScriptEngineManager scriptEngineManager;
static final String ID = "default";
private boolean enableScriptEngineCache;
// Key is mime-type. Value is engine for the particular mime-type. Cache can be used when the scriptEngine can be shared across multiple threads / requests (which is the case for nashorn)
private Map<String, ScriptEngine> scriptEngineCache;
private Config.Scope config;
@Override
public ScriptingProvider create(KeycloakSession session) {
lazyInit();
return new DefaultScriptingProvider(this);
}
@Override
public void init(Config.Scope config) {
this.config = config;
this.enableScriptEngineCache = config.getBoolean("enable-script-engine-cache", true);
logger.debugf("Enable script engine cache: %b", this.enableScriptEngineCache);
}
ScriptEngineManager getScriptEngineManager() {
return scriptEngineManager;
if (enableScriptEngineCache) {
scriptEngineCache = new ConcurrentHashMap<>();
}
}
boolean isEnableScriptEngineCache() {
@ -69,6 +65,10 @@ public class DefaultScriptingProviderFactory implements ScriptingProviderFactory
return scriptEngineCache;
}
Config.Scope getConfig() {
return config;
}
@Override
public void postInit(KeycloakSessionFactory factory) {
//NOOP
@ -84,17 +84,4 @@ public class DefaultScriptingProviderFactory implements ScriptingProviderFactory
return ID;
}
private void lazyInit() {
if (scriptEngineManager == null) {
synchronized (this) {
if (scriptEngineManager == null) {
scriptEngineManager = new ScriptEngineManager();
if (enableScriptEngineCache) {
scriptEngineCache = new ConcurrentHashMap<>();
}
}
}
}
}
}

14
testsuite/integration-arquillian/servers/auth-server/jboss/common/ant/configure.xml
View file

@ -257,4 +257,18 @@
</filterset>
</copy>
</target>
<!-- Needed on Java 15 and later -->
<target name="deploy-nashorn-module">
<copy todir="${cli.tmp.dir}">
<resources>
<file file="${common.resources}/jboss-cli/deploy-nashorn-module.cli"/>
</resources>
<filterset>
<filter token="NASHORN_JAR" value="${project.build.directory}/nashorn/nashorn-core-${nashorn.version}.jar"/>
</filterset>
</copy>
<echo>Nashorn module deployed</echo>
</target>
</project>

5
testsuite/integration-arquillian/servers/auth-server/jboss/common/jboss-cli/deploy-nashorn-module.cli Normal file
View file

@ -0,0 +1,5 @@
echo *** Installing nashorn-core module ***
module add --module-root-dir=../modules/system/layers/keycloak/ \
--name=org.openjdk.nashorn.nashorn-core \
--resources=@NASHORN_JAR@ \
--dependencies=asm.asm,jdk.dynalink

57
testsuite/integration-arquillian/servers/auth-server/jboss/pom.xml
View file

@ -732,5 +732,62 @@
</properties>
</profile>
<!-- Nashorn script engine needs to be manually added for the new Java versions as it is not part of the JDK anymore -->
<profile>
<id>jdk15</id>
<activation>
<jdk>[15,)</jdk>
</activation>
<build>
<pluginManagement>
<plugins>
<plugin>
<artifactId>maven-dependency-plugin</artifactId>
<executions>
<execution>
<id>copy-nashorn-module</id>
<phase>generate-resources</phase>
<goals>
<goal>copy</goal>
</goals>
<configuration>
<artifactItems>
<artifactItem>
<groupId>org.openjdk.nashorn</groupId>
<artifactId>nashorn-core</artifactId>
<version>${nashorn.version}</version>
<type>jar</type>
</artifactItem>
</artifactItems>
<outputDirectory>${project.build.directory}/nashorn</outputDirectory>
<overWriteIfNewer>true</overWriteIfNewer>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-antrun-plugin</artifactId>
<executions>
<execution>
<id>deploy-nashorn-module</id>
<phase>generate-resources</phase>
<goals>
<goal>run</goal>
</goals>
<configuration>
<target>
<ant antfile="${common.resources}/ant/configure.xml" target="deploy-nashorn-module" />
</target>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</pluginManagement>
</build>
</profile>
</profiles>
</project>

38
testsuite/integration-arquillian/servers/auth-server/quarkus/pom.xml
View file

@ -262,5 +262,43 @@
<auth.server.quarkus.cluster.config>ha</auth.server.quarkus.cluster.config>
</properties>
</profile>
<!-- Nashorn script engine needs to be manually added for the new Java versions as it is not part of the JDK anymore -->
<profile>
<id>jdk15</id>
<activation>
<jdk>[15,)</jdk>
</activation>
<dependencies>
<dependency>
<groupId>org.openjdk.nashorn</groupId>
<artifactId>nashorn-core</artifactId>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
<executions>
<execution>
<id>copy-dependencies-quarkus</id>
<phase>generate-resources</phase>
<goals>
<goal>copy-dependencies</goal>
</goals>
<configuration>
<outputDirectory>${auth.server.home}/providers</outputDirectory>
<includeArtifactIds>nashorn-core,asm,asm-util,asm-commons</includeArtifactIds>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
</profile>
</profiles>
</project>

6
testsuite/utils/pom.xml
View file

@ -254,6 +254,12 @@
<artifactId>mssql-jdbc</artifactId>
<version>${mssql.driver.version}</version>
</dependency>
<!-- Nashorn -->
<dependency>
<groupId>org.openjdk.nashorn</groupId>
<artifactId>nashorn-core</artifactId>
</dependency>
</dependencies>

7
testsuite/utils/src/main/java/org/keycloak/testsuite/TestPlatform.java
View file

@ -22,6 +22,7 @@ import java.io.IOException;
import java.nio.file.Files;
import org.jboss.logging.Logger;
import org.keycloak.Config;
import org.keycloak.platform.PlatformProvider;
public class TestPlatform implements PlatformProvider {
@ -70,4 +71,10 @@ public class TestPlatform implements PlatformProvider {
}
return tmpDir;
}
@Override
public ClassLoader getScriptEngineClassLoader(Config.Scope scriptProviderConfig) {
// It is fine to return null as nashorn should be automatically included on the classpath of testsuite utils
return null;
}
}

29
wildfly/extensions/src/main/java/org/keycloak/provider/wildfly/WildflyPlatform.java
View file

@ -20,6 +20,11 @@ package org.keycloak.provider.wildfly;
import java.io.File;
import org.jboss.logging.Logger;
import org.jboss.modules.Module;
import org.jboss.modules.ModuleIdentifier;
import org.jboss.modules.ModuleLoadException;
import org.keycloak.Config;
import org.keycloak.common.util.Environment;
import org.keycloak.platform.PlatformProvider;
import org.keycloak.services.ServicesLogger;
@ -27,6 +32,9 @@ public class WildflyPlatform implements PlatformProvider {
private static final Logger log = Logger.getLogger(WildflyPlatform.class);
// In this module, the attempt to load script engine will be done by default
private static final String DEFAULT_SCRIPT_ENGINE_MODULE = "org.openjdk.nashorn.nashorn-core";
Runnable shutdownHook;
private File tmpDir;
@ -74,4 +82,25 @@ public class WildflyPlatform implements PlatformProvider {
}
return tmpDir;
}
@Override
public ClassLoader getScriptEngineClassLoader(Config.Scope scriptProviderConfig) {
String engineModule = scriptProviderConfig.get("script-engine-module");
if (engineModule == null) {
engineModule = DEFAULT_SCRIPT_ENGINE_MODULE;
}
try {
Module module = Module.getContextModuleLoader().loadModule(ModuleIdentifier.fromString(engineModule));
log.infof("Found script engine module '%s'", engineModule);
return module.getClassLoader();
} catch (ModuleLoadException mle) {
if (WildflyUtil.getJavaVersion() >= 15) {
log.warnf("Cannot find script engine in the JBoss module '%s'. Please add JavaScript engine to the specified JBoss Module or make sure it is available on the classpath", engineModule);
} else {
log.debugf("Cannot find script engine in the JBoss module '%s'. Will fallback to the default script engine", engineModule);
}
return null;
}
}
}

40
wildfly/extensions/src/main/java/org/keycloak/provider/wildfly/WildflyUtil.java Normal file
View file

@ -0,0 +1,40 @@
/*
* Copyright 2022 Red Hat, Inc. and/or its affiliates
* and other contributors as indicated by the @author tags.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
*/
package org.keycloak.provider.wildfly;
/**
* @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
*/
public class WildflyUtil {
/**
* @return major version of java runtime like 8, 11 or 17
*/
public static int getJavaVersion() {
String version = System.getProperty("java.version");
if (version.startsWith("1.")) {
version = version.substring(2, 3);
} else {
int dot = version.indexOf(".");
if (dot != -1) version = version.substring(0, dot);
}
return Integer.parseInt(version);
}
}